CVE-2025-34217

In the Virtual Appliance system, there exists a hidden user 'printerlogic' whose '~/.ssh/authorized_keys' file contains a predefined (hardcoded) SSH public key — the corresponding private key is known or can be obtained by an attacker. At the same time, the 'printerlogic_ssh' group has an entry in the sudoers configuration with the NOPASSWD: ALL option, meaning any command can be executed as root without password entry. An attacker connects remotely via SSH, authenticating with the possessed private key, and immediately escalates privileges to root level.

An attacker gains full control over the Virtual Appliance device with root privileges — can read, modify and delete data, install malicious software, take control of print services, and potentially use the device as a pivot point for further lateral movement in the network.

Patches available from the vendor must be applied according to the references (https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm and https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm). Until updates are applied, it is recommended to restrict SSH access to the appliance only to trusted IP addresses at the firewall level and monitor login attempts to the 'printerlogic' account.

Vasion Print (formerly PrinterLogic) Virtual Appliance Application and Virtual Appliance Host (VA/SaaS deployments); specific versions indicated in vendor references